Abstract: Some embodiments provide a method for a network slice selector. From an electronic device, the method receives a connection initiation message for a connection between the electronic device and a network domain. The method exchanges a set of connection initiation messages with the electronic device to set up the connection. The method receives a data message belonging to the connection from the electronic device. The method selects one of multiple network slices to which the electronic device has access as the network slice for the connection based on analysis of the received data message. The method forwards the data message and subsequent data messages belonging to the connection onto the selected network slice to be delivered to the network domain.

Abstract: The disclosure provides an approach for transferring files to cloud storage so as to reduce usage of on-premise storage units, and for dynamically reading ahead from cloud storage to improve read performance. In one embodiment, each storage unit in an on-premise storage system is considered independently, and a decision made to move files from a storage unit to cloud storage when utilization of that storage unit reaches an associated mid-water-mark. In particular, files may be transferred beginning with least-recently accessed and smallest files and proceeding until utilization percentage of the on-premise storage unit decreases to an associated low-water-mark. In addition, while files are being transferred to cloud storage, additional files may be written to the on-premise storage unit until an associated high-water-mark is touched, at which point any further writes are redirected to the cloud storage until usage of the on-premise storage unit is reduced to the low-water-mark or more.

Abstract: One or more examples provide techniques for providing a multi-site wide area network in a cloud computing system. In an example, a method of providing a multi-site wide area network (WAN) in a cloud computing system includes: creating a plurality of sites; creating a compute profile in each of the plurality of sites, each compute profile having a compute cluster of virtual machines (VMs); creating a service mesh having the compute profile of each of the plurality of sites; and deploying an application to the service mesh.

Abstract: In some embodiments, a method determines when a packet is fragmented into multiple fragmented packets in a flow between a first workload and a second workload. The method switches from generating an outer source port in the outer header using layer 4 information from the inner header to using layer 3 information from the inner header. A fragmented packet is encapsulated with the outer header that includes an outer source port value that is generated using the layer 3 information. The method initiates a process to determine when to switch back to using layer 4 information from the inner header to generate the outer source port. When it is determined to switch back to using layer 4 information, the method switches back to using layer 4 information from the inner header to generate the source port in the outer header of a packet from the first workload.

Abstract: In a computer-implemented method for generating a privacy compliant audit log for a conversational interface, a request for information from a user is received at a conversational interface. A response to the request for information is generated, the response including data responsive to the request for information. It is determined whether the response comprises private user data. An audit log including the request and information related to the response is generated, where the information related to the response does not include the private user data.

Abstract: In a method for generating at least one smart link, a plurality of destination digital resources is received. At least one smart link is generated based on the plurality of destination digital resources, wherein the at least one smart link provides configurable access to the plurality of destination digital resources in response to an interaction with the at least one smart link.

Abstract: In a method for using a smart link to access a digital resource, a smart link access request is received from an electronic device interacting with a smart link, wherein a smart link provides access to at least one destination digital resource of a plurality of destination digital resources associated with the smart link. The at least one destination digital resource to access is determined based at least on the smart link access request. The electronic device is directed to the determined at least one destination digital resource.

Abstract: In a computer-implemented method for name type identification, a list of names is received. A probability that each name of the list of names is one of a given name and a surname is determined. Each name of the list of names is determined as one of a given name and a surname based on the probability. Entities of the list of names are determined based on the identifying each name of the list of names as one of a given name and a surname, wherein an entity includes one of a given name, a surname, and a given name/surname combination.

Abstract: A system and method for automatically adjusting a learning mode duration on a virtual computing instance for an application security system extends a minimum duration of time for the learning mode duration for a guest agent running in the virtual computing instance based on a condition with respect to suspicious activities and deviations from normal behaviors detected during a fixed time interval. The guest agent is switched to a protected mode when the condition with respect to the suspicious activities and the deviations from the normal behaviors is satisfied for any fixed time interval after the minimum duration of time.

Abstract: Examples for managing virtual infrastructure resources in cloud environments can include (1) instantiating an orchestration node for managing local control planes at multiple clouds, (2) instantiating first and second local control planes at different respective clouds, the first and second local control planes interfacing with different respective virtualized infrastructure managers (“VIMs”), where the first and second local control planes establish secure communication with the orchestration node, and (3) deploying, by the orchestration node, services to the first and second local control planes. Further, the first and second local control planes can cause the respective VIMs to manage the services at the different respective clouds.

Abstract: Some embodiments provide a method of identifying packet latency in a software defined datacenter (SDDC) that includes a network, several host computers executing several machines, and a set of one or more controllers. At the set of controllers, the method o receives, from a set of host computers, (i) a first set of time values associated with multiple packet processing operations performed on packets sent by a set of machines executing on the set of host computers and (ii) a second set of time values associated with packet transmission between host computers through the SDDC network. The method processes the first and second sets of time values to identify a set of latencies experienced by multiple packets processed and transmitted in the SDDC.

Abstract: The current document is directed to methods and systems for simulation-based training of automated reinforcement-learning-based application managers. Simulators are generated from data collected from controlled computing environments controlled and may employ any of a variety of different machine-learning models to learn state-transition and reward models. The current disclosed methods and systems provide facilities for visualizing aspects of the models learned by a simulator and for initializing simulator models using domain information. In addition, the currently disclosed simulators employ weighted differences computed from simulator-generated and training-data state transitions for feedback to the machine-learning models to address various biases and deficiencies of commonly employed difference metrics in the context of training automated reinforcement-learning-based application managers.

Abstract: Users of a client computer having non-conventional input devices interact with a host computing platform with the same user experience as if he or she was operating the client computer natively. This is achieved by having the non-conventional input devices of the client device appear local to the applications that are running on the host platform, even though the host computing platform may not be equipped with drivers for the non-conventional input devices.

Abstract: Some embodiments of the invention provide a novel method of performing network slice-based operations on a data message at a hardware forwarding element (HFE) in a network. For a received data message flow, the method has the HFE identify a network slice associated with the received data message flow. This network slice in some embodiments is associated with a set of operations to be performed on the data message by several network elements, including one or more machines executing on one or more computers in the network. Once the network slice is identified, the method has the HFE process the data message flow based on a rule that applies to data messages associated with the identified slice.

Abstract: Example methods are provided to provide synchronization between multiple pop-up windows that are displayed by a user interface. The pop-up windows may render graphical representations of usage data provided through operational metrics associated with elements in a virtualized computing environment. User navigation to a navigation point in one pop-up window results in a similar navigation to another navigation point in another pop-up window, such that information in for the navigation points in both pop-up windows may be presented in accordance with a common timestamp.

Abstract: Example methods and systems for score-based dynamic firewall rule enforcement in a software-defined networking (SDN) environment. One example method may comprise in response to detecting a first request to access a first resource, identifying a first score associated with the user, and a firewall rule that is applicable to the user based on information associated with the user. The firewall rule may be applied to allow access to the first resource. The method may further comprise adjusting the first score to a second score that represents a more restrictive access level compared to the first score. In response to detecting a second request to access the first resource, applying the firewall rule to block the second request based on the second score.

Abstract: Operating system update management for enrolled devices is disclosed according to various examples. In one example, a computing environment can publish, to an agent application on a client device, a deployment profile with a setting that specifies a restriction associated with download or installation of software updates by a subset of client devices that includes the client device. The computing environment can receive, from the agent application, an identification of a software update available for the client device. The computing environment can receive a specification of the subset of client devices to apply the software update. In response to a predefined interaction being performed, for example, by an administrator, the computing environment can direct at least one client device in the subset to install the software update.

Abstract: Techniques are disclosed for reallocating host resources in a virtualized computing environment when certain criteria have been met. In some embodiments, a system identifies a host disabling event. In view of the disabling event, the system identifies a resource for reallocation from a first host to a second host. Based on the identification, the computer system disassociates the identified resource's virtual identifier from the first host device and associates the virtual identifier with the second host device. Thus, the techniques disclosed significantly reduce a system's planned and unplanned downtime.

Abstract: Methods and devices for providing reserved failover capacity across a plurality of data centers are described herein. An exemplary method includes determining whether a management process is executing at a first data center corresponding to a first physical location. In accordance with a determination that the management process is not executing at the first data center corresponding to the first physical location a host is initiated at a second data center corresponding to a second physical location and the management process is executed on the initiated host at the second data center corresponding to the second physical location.

Abstract: Example methods and computer systems for packet handling for active-active stateful service insertion are disclosed. One example may involve a computer system detecting a packet addressed from a source address to a service endpoint address. Based on configuration information associated with the service endpoint address, the computer system may identify a first active logical service router (SR) and a second active logical SR that are both associated with the service endpoint address and configured to operate in an active-active mode. The first active logical SR may be selected over the second active logical SR by mapping tuple information to the first active logical SR. The computer system may generate an encapsulated packet by encapsulating the packet with an outer header addressed to an outer destination address associated with the first active logical SR and send the encapsulated packet towards the first active logical SR for processing according to a stateful service.